ip_fil_solaris.c revision e8d569f4dee6d4527486afe349febb4304d5a7a5
/*
* Copyright (C) 1993-2001, 2003 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#if !defined(lint)
static const char sccsid[] = "@(#)ip_fil_solaris.c 1.7 07/22/06 (C) 1993-2000 Darren Reed";
static const char rcsid[] = "@(#)$Id: ip_fil_solaris.c,v 2.62.2.19 2005/07/13 21:40:46 darrenr Exp $";
#endif
#include <sys/cred_impl.h>
#include <sys/dditypes.h>
#include <netinet/in_systm.h>
#include "netinet/ip_compat.h"
#ifdef USE_INET6
#endif
#include "netinet/ip_state.h"
#include "netinet/ip_proxy.h"
#include "netinet/ipf_stack.h"
#ifdef IPFILTER_LOOKUP
# include "netinet/ip_lookup.h"
#endif
void *));
void *));
void *));
#if SOLARIS2 < 10
#if SOLARIS2 >= 7
# if SOLARIS2 >= 8
int *ip_forwarding = NULL;
# else
# endif
#else
#endif
#endif
/* ------------------------------------------------------------------------ */
/* Function: ipldetach */
/* Returns: int - 0 == success, else error. */
/* Parameters: Nil */
/* */
/* This function is responsible for undoing anything that might have been */
/* done in a call to iplattach(). It must be able to clean up from a call */
/* to iplattach() that did not succeed. Why might that happen? Someone */
/* configures a table to be so large that we cannot allocate enough memory */
/* for it. */
/* ------------------------------------------------------------------------ */
{
#if SOLARIS2 < 10
if (ip_forwarding != NULL)
*ip_forwarding = 0;
#if SOLARIS2 >= 8
if (ip6_forwarding != NULL)
*ip6_forwarding = 0;
#endif
}
#endif
/*
* This lock needs to be dropped around the net_hook_unregister calls
* because we can deadlock here with:
* W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs
* R(hook_family)->R(hei_lock)->R(ipf_global) (active hook running)
*/
do { \
} \
} \
} \
} while (0)
/*
* Remove IPv6 Hooks
*/
goto detach_failed;
}
/*
* Remove IPv4 Hooks
*/
goto detach_failed;
}
#ifdef IPFDEBUG
#endif
ifs->ifs_ipf_locks_done = 0;
}
return -1;
return 0;
return -1;
}
{
#if SOLARIS2 < 10
int i;
#endif
#ifdef IPFDEBUG
#endif
#ifdef _KERNEL
ifs->ifs_fr_update_ipid = 0;
#else
#endif
#if defined(IPFILTER_DEFAULT_BLOCK)
#else
#endif
if (fr_initialise(ifs) < 0)
return -1;
"ipfilter_hook4_nicevents", ifs);
"ipfilter_hook4_in", ifs);
"ipfilter_hook4_out", ifs);
"ipfilter_hook4_loop_in", ifs);
"ipfilter_hook4_loop_out", ifs);
/*
* If we hold this lock over all of the net_hook_register calls, we
* can cause a deadlock to occur with the following lock ordering:
* W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs
* R(hook_family)->R(hei_lock)->R(ipf_global) (packet path)
*/
/*
* Add IPv4 hooks
*/
goto hookup_failed;
if (!ifs->ifs_hook4_nic_events)
goto hookup_failed;
if (!ifs->ifs_hook4_physical_in)
goto hookup_failed;
if (!ifs->ifs_hook4_physical_out)
goto hookup_failed;
if (ifs->ifs_ipf_loopback) {
ifs->ifs_ipfhook4_loop_in) == 0);
if (!ifs->ifs_hook4_loopback_in)
goto hookup_failed;
ifs->ifs_ipfhook4_loop_out) == 0);
if (!ifs->ifs_hook4_loopback_out)
goto hookup_failed;
}
/*
* Add IPv6 hooks
*/
goto hookup_failed;
"ipfilter_hook6_nicevents", ifs);
"ipfilter_hook6_in", ifs);
"ipfilter_hook6_out", ifs);
"ipfilter_hook6_loop_in", ifs);
"ipfilter_hook6_loop_out", ifs);
if (!ifs->ifs_hook6_nic_events)
goto hookup_failed;
if (!ifs->ifs_hook6_physical_in)
goto hookup_failed;
if (!ifs->ifs_hook6_physical_out)
goto hookup_failed;
if (ifs->ifs_ipf_loopback) {
ifs->ifs_ipfhook6_loop_in) == 0);
if (!ifs->ifs_hook6_loopback_in)
goto hookup_failed;
ifs->ifs_ipfhook6_loop_out) == 0);
if (!ifs->ifs_hook6_loopback_out)
goto hookup_failed;
}
/*
* Reacquire ipf_global, now it is safe.
*/
/* Do not use private interface ip_params_arr[] in Solaris 10 */
#if SOLARIS2 < 10
#if SOLARIS2 >= 8
#endif
/*
* XXX - There is no terminator for this array, so it is not possible
* to tell if what we are looking for is missing and go off the end
* of the array.
*/
#if SOLARIS2 <= 8
for (i = 0; ; i++) {
"ip_path_mtu_discovery")) {
}
#if SOLARIS2 < 8
"ip_forwarding")) {
}
#else
"ip6_forwarding")) {
}
#endif
#if SOLARIS2 >= 8
ip6_forwarding != NULL &&
#endif
ip_forwarding != NULL)
break;
}
#endif
if (ip_forwarding != NULL)
*ip_forwarding = 1;
#if SOLARIS2 >= 8
if (ip6_forwarding != NULL)
*ip6_forwarding = 1;
#endif
}
#endif
return 0;
return -1;
}
int set;
{
return EFAULT;
ifs->ifs_ipfhook4_loop_in) == 0);
if (!ifs->ifs_hook4_loopback_in)
return EINVAL;
ifs->ifs_ipfhook4_loop_out) == 0);
if (!ifs->ifs_hook4_loopback_out)
return EINVAL;
ifs->ifs_ipfhook6_loop_in) == 0);
if (!ifs->ifs_hook6_loopback_in)
return EINVAL;
ifs->ifs_ipfhook6_loop_out) == 0);
if (!ifs->ifs_hook6_loopback_out)
return EINVAL;
ifs->ifs_ipf_loopback = 0;
if (ifs->ifs_hook4_loopback_in)
return EBUSY;
if (ifs->ifs_hook4_loopback_out)
return EBUSY;
if (ifs->ifs_hook6_loopback_in)
return EBUSY;
if (ifs->ifs_hook6_loopback_out)
return EBUSY;
}
return 0;
}
/*
* Filter ioctl interface.
*/
/*ARGSUSED*/
int cmd;
#if SOLARIS2 >= 7
#else
int *data;
#endif
int mode;
int *rp;
{
#ifdef IPFDEBUG
#endif
if (IPL_LOGMAX < unit)
return ENXIO;
/*
* As we're calling ipf_find_stack in user space, from a given zone
* to find the stack pointer for this zone, there is no need to have
*/
if (ifs->ifs_fr_running <= 0) {
if (unit != IPL_LOGIPF) {
return EIO;
}
return EIO;
}
}
if (ifs->ifs_fr_enable_active != 0) {
return EBUSY;
}
if (error != -1) {
return error;
}
error = 0;
switch (cmd)
{
case SIOCFRENB :
else {
sizeof(enable));
if (error != 0) {
break;
}
/*
* We must recheck fr_enable_active here, since we've
* dropped ifs_ipf_global from R in order to get it
* exclusively.
*/
if (ifs->ifs_fr_enable_active == 0) {
ifs->ifs_fr_enable_active = 0;
}
}
break;
case SIOCIPFSET :
break;
}
/* FALLTHRU */
case SIOCIPFGETNEXT :
case SIOCIPFGET :
break;
case SIOCSETFF :
else {
sizeof(ifs->ifs_fr_flags));
if (error != 0)
}
break;
case SIOCIPFLP :
sizeof(tmp));
if (error != 0)
else
break;
case SIOCGETFF :
sizeof(ifs->ifs_fr_flags));
if (error != 0)
break;
case SIOCFUNCL :
break;
case SIOCINAFR :
case SIOCRMAFR :
case SIOCADAFR :
case SIOCZRLST :
else
break;
case SIOCINIFR :
case SIOCRMIFR :
case SIOCADIFR :
else
break;
case SIOCSWAPA :
else {
sizeof (ifs->ifs_frcache));
sizeof(ifs->ifs_fr_active));
if (error != 0)
else
}
break;
case SIOCGETFS :
break;
case SIOCFRZST :
else
break;
case SIOCIPFFL :
else {
sizeof(tmp));
if (!error) {
sizeof(tmp));
if (error != 0)
} else
}
break;
#ifdef USE_INET6
case SIOCIPFL6 :
else {
sizeof(tmp));
if (!error) {
sizeof(tmp));
if (error != 0)
} else
}
break;
#endif
case SIOCSTLCK :
if (error == 0) {
} else
break;
#ifdef IPFILTER_LOG
case SIOCIPFFB :
else {
sizeof(tmp));
if (error)
}
break;
#endif /* IPFILTER_LOG */
case SIOCFRSYN :
else {
error = 0;
}
break;
case SIOCGFRST :
break;
case FIONREAD :
#ifdef IPFILTER_LOG
if (error != 0)
#endif
break;
case SIOCIPFITER :
break;
case SIOCGENITER :
break;
case SIOCIPFDELTOK :
if (error != 0) {
} else {
}
break;
default :
#ifdef IPFDEBUG
#endif
break;
}
return error;
}
int enable;
{
int error;
if (!enable) {
if (error == 0)
return error;
}
if (ifs->ifs_fr_running > 0)
return 0;
if (error == 0) {
(void *)ifs,
hz);
}
} else {
}
return error;
}
char *name;
int v;
{
if (v == 4)
else if (v == 6)
else
return 0;
}
/*
* routines below for saving IP headers to buffer
*/
/*ARGSUSED*/
{
#ifdef IPFDEBUG
#endif
return ENXIO;
return min;
}
/*ARGSUSED*/
{
#ifdef IPFDEBUG
#endif
return min;
}
#ifdef IPFILTER_LOG
/*
* both of these must operate with at least splnet() lest they be
* called during packet processing and cause an inconsistancy to appear in
* the filter lists.
*/
/*ARGSUSED*/
{
int ret;
/*
* As we're calling ipf_find_stack in user space, from a given zone
* to find the stack pointer for this zone, there is no need to have
*/
# ifdef IPFDEBUG
# endif
return EIO;
}
# ifdef IPFILTER_SYNC
return ipfsync_read(uio);
}
# endif
return ret;
}
#endif /* IPFILTER_LOG */
/*
* both of these must operate with at least splnet() lest they be
* called during packet processing and cause an inconsistancy to appear in
* the filter lists.
*/
{
/*
* As we're calling ipf_find_stack in user space, from a given zone
* to find the stack pointer for this zone, there is no need to have
*/
#ifdef IPFDEBUG
#endif
return EIO;
}
#ifdef IPFILTER_SYNC
return ipfsync_write(uio);
#endif /* IPFILTER_SYNC */
return ENXIO;
}
/*
* fr_send_reset - this could conceivably be a call to tcp_respond(), but that
* requires a large amount of setting up and isn't any more efficient.
*/
int fr_send_reset(fin)
{
mblk_t *m;
#ifdef USE_INET6
#endif
return -1;
#ifndef IPFILTER_CKSUM
return -1;
#endif
#ifdef USE_INET6
else
#endif
return -1;
m->b_rptr += 64;
} else {
}
#ifdef USE_INET6
} else
#endif
{
}
return fr_send_ip(fin, m, &m);
}
/*
* Function: fr_send_ip
* Returns: 0: success
* -1: failed
* Parameters:
* fin: packet information
* m: the message block where ip head starts
*
* Send a new packet through the IP stack.
*
* For IPv4 packets, ip_len must be in host byte order, and ip_v,
* ip_ttl, ip_off, and ip_sum are ignored (filled in by this
* function).
*
* For IPv6 packets, ip6_flow, ip6_vfc, and ip6_hlim are filled
* in by this function.
*
* All other portions of the packet must be in on-the-wire format.
*/
/*ARGSUSED*/
{
int i, hlen;
#ifdef USE_INET6
} else
#endif
{
#if SOLARIS2 >= 10
#else
if (ip_ttl_ptr != NULL)
else
if (ip_mtudisc != NULL)
else
#endif
/*
* fr_fastroute, it expects them to be in host byte order but
* ipf_cksum expects them to be in network byte order.
*/
}
return i;
}
int type;
int dst;
{
#ifdef USE_INET6
#endif
mblk_t *m;
#ifdef USE_INET6
#endif
return -1;
#ifdef USE_INET6
return -1;
#endif
#ifndef IPFILTER_CKSUM
return -1;
#endif
#ifdef USE_INET6
if (type == ICMP6_DST_UNREACH)
} else
#endif
{
{
case ICMP_ECHO :
case ICMP_TSTAMP :
case ICMP_IREQ :
case ICMP_MASKREQ :
break;
default :
return 0;
}
}
return -1;
m->b_rptr += 64;
#ifdef USE_INET6
int csz;
if (dst == 0) {
FREE_MB_T(m);
return -1;
}
} else
} else
#endif
{
if (dst == 0) {
FREE_MB_T(m);
return -1;
}
} else {
}
}
/*
* Need to exit out of these so we don't recursively call rw_enter
* from fr_qout.
*/
return fr_send_ip(fin, m, &m);
}
#ifndef _KERNEL
#include <stdio.h>
#endif
/*
* Print out warning message at rate-limited speed.
*/
{
char msg_buf[256];
int need_printed = 0;
now = ddi_get_time();
/* make sure, no multiple entries */
need_printed = 1;
}
if (need_printed) {
#ifdef _KERNEL
#else
#endif
}
}
/*
* Return the first IP Address associated with an interface
* For IPv6, we walk through the list of logical interfaces and return
* the address of the first one that isn't a link-local interface.
* We can't assume that it is :1 because another link-local address
* may have been assigned there.
*/
/*ARGSUSED*/
int v, atype;
void *ifptr;
{
void *array;
switch (v)
{
case 4:
break;
case 6:
break;
default:
break;
}
return -1;
switch (atype)
{
case FRI_PEERADDR :
break;
case FRI_BROADCAST :
type[0] = NA_BROADCAST;
break;
default :
type[0] = NA_ADDRESS;
break;
}
if (v == 6) {
do {
array) < 0)
return -1;
break;
} while (idx != 0);
if (idx == 0)
return -1;
}
return -1;
}
{
static int iss_seq_off = 0;
/*
* Compute the base value of the ISS. It is a hash
* of (saddr, sport, daddr, dport, secret).
*/
/*
* Now increment our "timer", and add it in to
* the computed value.
*
* XXX Use `addin'?
* XXX TCP_ISSINCR too large to use?
*/
iss_seq_off += 0x00010000;
newiss += iss_seq_off;
return newiss;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_nextipid */
/* Returns: int - 0 == success, -1 == error (packet should be droppped) */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* Returns the next IPv4 ID to use for this packet. */
/* ------------------------------------------------------------------------ */
{
if (fin->fin_pktnum != 0) {
} else {
}
return id;
}
#ifndef IPFILTER_CKSUM
/* ARGSUSED */
#endif
{
#ifdef IPFILTER_CKSUM
#endif
}
#ifdef USE_INET6
# ifndef IPFILTER_CKSUM
/* ARGSUSED */
# endif
{
# ifdef IPFILTER_CKSUM
# endif
}
#endif /* USE_INET6 */
#if (SOLARIS2 < 7)
void fr_slowtimer()
#else
/*ARGSUSED*/
#endif
{
return;
}
ifs->ifs_fr_ticks++;
drv_usectohz(500000));
else
}
/* ------------------------------------------------------------------------ */
/* Function: fr_pullup */
/* Returns: NULL == pullup failed, else pointer to protocol header */
/* Parameters: m(I) - pointer to buffer where data packet starts */
/* fin(I) - pointer to packet information */
/* len(I) - number of bytes to pullup */
/* */
/* Attempt to move at least len bytes (from the start of the buffer) into a */
/* single buffer for ease of access. Operating system native functions are */
/* used to manage buffers - if necessary. If the entire packet ends up in */
/* a single buffer, set the FI_COALESCE flag even though fr_coalesce() has */
/* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */
/* and ONLY if the pullup succeeds. */
/* */
/* We assume that 'min' is a pointer to a buffer that is part of the chain */
/* of buffers that starts at *fin->fin_mp. */
/* ------------------------------------------------------------------------ */
int len;
{
char *ip;
if (m == NULL)
return NULL;
return ip;
else
dpoff = 0;
/*
* pfil_precheck ensures the IP header is on a 32bit
* aligned address so simply fail if that isn't currently
* the case (should never happen).
*/
int inc = 0;
if (ipoff > 0) {
if ((ipoff & 3) != 0) {
else
inc = 0;
}
}
/*
* XXX This is here as a work around for a bug with DEBUG
* XXX Solaris kernels. The problem is b_prev is used by IP
* XXX code as a way to stash the phyint_index for a packet,
* XXX this doesn't get reset by IP but freeb does an ASSERT()
* XXX for both of these to be NULL. See 6442390.
*/
m1 = m;
do {
} while (m1);
/*
* Need to preserve checksum information by copying them
* to newmp which heads the pulluped message.
*/
return NULL;
}
}
return ip;
}
/*
* Function: fr_verifysrc
* Returns: int (really boolean)
* Parameters: fin - packet information
*
* Check whether the packet has a valid source address for the interface on
* which the packet arrived, implementing the "fr_chksrc" feature.
* Returns true iff the packet's source address is valid.
*/
int fr_verifysrc(fin)
{
} else {
return (0);
}
/* Get the index corresponding to the if name */
}
/*
* Function: fr_fastroute
* Returns: 0: success;
* -1: failed
* Parameters:
* mb: the message block where ip head starts
* mpp: the pointer to the pointer of the orignal
* packet message
* fin: packet information
* fdp: destination interface information
* if it is NULL, no interface information provided.
*
* pfil_make_lay2_packet to search route, make lay-2 header
* ,and identify output queue for the IP packet.
* The destination address depends on the following conditions:
* 1: for fastroute rule, fdp is passed in as NULL, so the
* destination address is the IP Packet's destination address
* the interface name, this address is the as destination
* address. Otherwise IP Packet's destination address is used
*/
{
struct sockaddr_in *sin;
struct sockaddr_in6 *sin6;
#ifndef sparc
#endif
} else {
return (-1);
}
return -1;
/*
* If this is a duplicate mblk then we want ip to point at that
* data, not the original, if and only if it is already pointing at
* the current mblk data.
*
* Otherwise, if it's not a duplicate, and we're not already pointing
* at the current mblk data, then we want to ensure that the data
* points at ip.
*/
}
/*
* If there is another M_PROTO, we don't want it
*/
}
/*
* In case we're here due to "to <if>" being used with
* "keep state", check that we're going in the correct
* direction.
*/
goto bad_fastroute;
} else {
}
} else {
} else {
}
}
/*
* Clear the hardware checksum flags from packets that we are doing
* input processing on as leaving them set will cause the outgoing
* NIC (if it supports hardware checksum) to calculate them anew,
* using the old (correct) checksums as the pseudo value to start
* from.
*/
DB_CKSUMFLAGS(mb) = 0;
}
void *saveifp;
goto bad_fastroute;
}
#ifndef sparc
}
#endif
if (net_data_p) {
return (-1);
}
}
ifs->ifs_fr_frouteok[0]++;
return 0;
return -1;
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_hook4_out */
/* Returns: int - 0 == packet ok, else problem, free packet if not done */
/* Parameters: event(I) - pointer to event */
/* info(I) - pointer to hook information for firewalling */
/* */
/* Calling ipf_hook. */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
{
}
/*ARGSUSED*/
{
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_hook4_in */
/* Returns: int - 0 == packet ok, else problem, free packet if not done */
/* Parameters: event(I) - pointer to event */
/* info(I) - pointer to hook information for firewalling */
/* */
/* Calling ipf_hook. */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
{
}
/*ARGSUSED*/
{
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_hook4_loop_out */
/* Returns: int - 0 == packet ok, else problem, free packet if not done */
/* Parameters: event(I) - pointer to event */
/* info(I) - pointer to hook information for firewalling */
/* */
/* Calling ipf_hook. */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
{
}
/*ARGSUSED*/
{
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_hook4_loop_in */
/* Returns: int - 0 == packet ok, else problem, free packet if not done */
/* Parameters: event(I) - pointer to event */
/* info(I) - pointer to hook information for firewalling */
/* */
/* Calling ipf_hook. */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
{
}
/*ARGSUSED*/
{
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_hook */
/* Returns: int - 0 == packet ok, else problem, free packet if not done */
/* Parameters: info(I) - pointer to hook information for firewalling */
/* out(I) - whether packet is going in or out */
/* loopback(I) - whether packet is a loopback packet or not */
/* */
/* Stepping stone function between the IP mainline and IPFilter. Extracts */
/* parameters out of the info structure and forms them up to be useful for */
/* calling ipfilter. */
/* ------------------------------------------------------------------------ */
{
/* For fastroute cases, fr_check returns 0 with mp set to NULL */
rval = 1;
/* Notify IP the packet mblk_t and IP header pointers. */
if (rval == 0) {
}
return rval;
}
{
/* For fastroute cases, fr_check returns 0 with mp set to NULL */
rval = 1;
/* Notify IP the packet mblk_t and IP header pointers. */
return rval;
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_nic_event_v4 */
/* Returns: int - 0 == no problems encountered */
/* Parameters: event(I) - pointer to event */
/* info(I) - pointer to information about a NIC event */
/* */
/* Function to receive asynchronous NIC events from IP */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
{
struct sockaddr_in *sin;
if (ifs->ifs_fr_running <= 0)
return (0);
{
case NE_PLUMB :
ifs);
break;
case NE_UNPLUMB :
ifs);
break;
case NE_ADDRESS_CHANGE :
/*
* We only respond to events for logical interface 0 because
* IPFilter only uses the first address given to a network
* interface. We check for hne_lif==1 because the netinfo
* code maps adds 1 to the lif number so that it can return
* 0 to indicate "no more lifs" when walking them.
*/
ifs);
ifs);
}
break;
#if SOLARIS2 >= 10
case NE_IFINDEX_CHANGE :
/*
* The netinfo passes interface index as int (hne_data should be
* handled as a pointer to int), which is always 32bit. We need to
* convert it to void pointer here, since interfaces are
* represented as pointers to void in IPF. The pointers are 64 bits
* long on 64bit platforms. Doing something like
* (void *)((int) x)
* will throw warning:
* "cast to pointer from integer of different size"
* during 64bit compilation.
*
* The line below uses (size_t) to typecast int to
* size_t, which might be 64bit/32bit (depending
* on architecture). Once we have proper 64bit/32bit
* type (size_t), we can safely convert it to void pointer.
*/
}
break;
#endif
default :
break;
}
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: ipf_nic_event_v6 */
/* Returns: int - 0 == no problems encountered */
/* Parameters: event(I) - pointer to event */
/* info(I) - pointer to information about a NIC event */
/* */
/* Function to receive asynchronous NIC events from IP */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
{
struct sockaddr_in6 *sin6;
if (ifs->ifs_fr_running <= 0)
return (0);
{
case NE_PLUMB :
break;
case NE_UNPLUMB :
ifs);
break;
case NE_ADDRESS_CHANGE :
ifs);
}
break;
#if SOLARIS2 >= 10
case NE_IFINDEX_CHANGE :
/*
* The netinfo passes interface index as int (hne_data should be
* handled as a pointer to int), which is always 32bit. We need to
* convert it to void pointer here, since interfaces are
* represented as pointers to void in IPF. The pointers are 64 bits
* long on 64bit platforms. Doing something like
* (void *)((int) x)
* will throw warning:
* "cast to pointer from integer of different size"
* during 64bit compilation.
*
* The line below uses (size_t) to typecast int to
* size_t, which might be 64bit/32bit (depending
* on architecture). Once we have proper 64bit/32bit
* type (size_t), we can safely convert it to void pointer.
*/
}
break;
#endif
default :
break;
}
return 0;
}
/*
* Functions fr_make_rst(), fr_make_icmp_v4(), fr_make_icmp_v6()
* are needed in Solaris kernel only. We don't need them in
*/
/* ------------------------------------------------------------------------ */
/* Function: fr_make_rst */
/* Returns: int - 0 on success, -1 on failure */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* We must alter the original mblks passed to IPF from IP stack via */
/* FW_HOOKS. FW_HOOKS interface is powerfull, but it has some limitations. */
/* IPF can basicaly do only these things with mblk representing the packet: */
/* leave it as it is (pass the packet) */
/* */
/* discard it (block the packet) */
/* */
/* alter it (i.e. NAT) */
/* */
/* As you can see IPF can not simply discard the mblk and supply a new one */
/* instead to IP stack via FW_HOOKS. */
/* */
/* The return-rst action for packets coming via NIC is handled as follows: */
/* mblk with packet is discarded */
/* */
/* new mblk with RST response is constructed and injected to network */
/* */
/* IPF can't inject packets to loopback interface, this is just another */
/* limitation we have to deal with here. The only option to send RST */
/* response to offending TCP packet coming via loopback is to alter it. */
/* */
/* loopback interface into TCP RST packet. fin->fin_mp is pointer to */
/* ------------------------------------------------------------------------ */
int fr_make_rst(fin)
{
int rv = -1;
#ifdef USE_INET6
#endif
/*
* We do not need to adjust chksum, since it is not being checked by
* Solaris IP stack for loopback clients.
*/
/* Swap IPv4 addresses. */
rv = 0;
}
else
}
#ifdef USE_INET6
/*
* We are relying on fact the next header is TCP, which is true
* for regular TCP packets coming in over loopback.
*/
/* Swap IPv6 addresses. */
rv = 0;
}
else
}
#endif
/*
* Adjust TCP header:
* swap ports,
* set flags,
* set correct ACK number
*/
}
return (rv);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_make_icmp_v4 */
/* Returns: int - 0 on success, -1 on failure */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* Please read comment at fr_make_icmp() wrapper function to get an idea */
/* what is going to happen here and why. Once you read the comment there, */
/* continue here with next paragraph. */
/* */
/* To turn IPv4 packet into ICMPv4 response packet, these things must */
/* happen here: */
/* (1) Original mblk is copied (duplicated). */
/* */
/* (2) ICMP header is created. */
/* */
/* (3) Link ICMP header with copy of original mblk, we have ICMPv4 */
/* data ready then. */
/* */
/* (4) Swap IP addresses in original mblk and adjust IP header data. */
/* */
/* (5) The mblk containing original packet is trimmed to contain IP */
/* header only and ICMP chksum is computed. */
/* */
/* (6) The ICMP header we have from (3) is linked to original mblk, */
/* which now contains new IP header. If original packet was spread */
/* over several mblks, only the first mblk is kept. */
/* ------------------------------------------------------------------------ */
static int fr_make_icmp_v4(fin)
{
int len;
return (-1);
/*
*/
return (-1);
/*
* Step (1)
*
* Make copy of original mblk.
*
* We want to copy as much data as necessary, not less, not more. The
* ICMPv4 payload length for unreachable messages is:
* original IP header + 8 bytes of L4 (if there are any).
*
* We determine if there are at least 8 bytes of L4 data following IP
* header first.
*/
/*
* Since we don't want to copy more data than necessary, we must trim
* the original mblk here. The right way (STREAMish) would be to use
* adjmsg() to trim it. However we would have to calculate the length
* argument for adjmsg() from pointers we already have here.
*
* Since we have pointers and offsets, it's faster and easier for
* us to just adjust pointers by hand instead of using adjmsg().
*/
/*
* Also we don't want to copy any L2 stuff, which might precede IP
* header, so we have have to set b_rptr to point to the start of IP
* header.
*/
return (-1);
/*
* Step (2)
*
* Create an ICMP header, which will be appened to original mblk later.
* ICMP header is just another mblk.
*/
return (-1);
}
icmp->icmp_cksum = 0;
/*
* Step (3)
*
* Complete ICMP packet - link ICMP header with L4 data from original
* IP packet.
*/
/*
* Step (4)
*
* Swap IP addresses and change IP header fields accordingly in
* original IP packet.
*
* There is a rule option return-icmp as a dest for physical
* interfaces. This option becomes useless for loopback, since IPF box
* uses same address as a loopback destination. We ignore the option
* here, the ICMP packet will always look like as it would have been
* sent from the original destination host.
*/
/*
* Step (5)
*
* We trim the orignal mblk to hold IP header only.
*/
/*
* ICMP chksum calculation. The data we are calculating chksum for are
* spread over two mblks, therefore we have to use two for loops.
*
* First for loop computes chksum part for ICMP header.
*/
/*
* Here we add chksum part for ICMP payload.
*/
len = icmp_pld_len;
/*
* Chksum is done.
*/
/*
* Step (6)
*
* Release all packet mblks, except the first one.
*/
}
/*
* Append ICMP payload to first mblk, which already contains new IP
* header.
*/
return (0);
}
#ifdef USE_INET6
/* ------------------------------------------------------------------------ */
/* Function: fr_make_icmp_v6 */
/* Returns: int - 0 on success, -1 on failure */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* Please read comment at fr_make_icmp() wrapper function to get an idea */
/* what and why is going to happen here. Once you read the comment there, */
/* continue here with next paragraph. */
/* */
/* This function turns IPv6 packet (UDP, TCP, ...) into ICMPv6 response. */
/* The algorithm is fairly simple: */
/* 1) We need to get copy of complete mblk. */
/* */
/* 2) New ICMPv6 header is created. */
/* */
/* 3) The copy of original mblk with packet is linked to ICMPv6 */
/* header. */
/* */
/* 4) The checksum must be adjusted. */
/* */
/* 5) IP addresses in original mblk are swapped and IP header data */
/* are adjusted (protocol number). */
/* */
/* 6) Original mblk is trimmed to hold IPv6 header only, then it is */
/* linked with the ICMPv6 data we got from (3). */
/* ------------------------------------------------------------------------ */
static int fr_make_icmp_v6(fin)
{
return (-1);
/*
*/
return (-1);
/*
* Step (1)
*
* We need to copy complete packet in case of IPv6, no trimming is
* needed (except the L2 headers).
*/
return (-1);
/*
* Step (2)
*
* Allocate and create ICMP header.
*/
BPRI_HI);
return (-1);
icmp6->icmp6_data32[0] = 0;
/*
* Step (3)
*
* Link the copy of IP packet to ICMP header.
*/
/*
* Step (4)
*
* Calculate chksum - this is much more easier task than in case of
* IPv4 - ICMPv6 chksum only covers IP addresses, and payload length.
* We are making compensation just for change of packet length.
*/
/*
* Step (5)
*
* Swap IP addresses.
*/
/*
* and adjust IP header data.
*/
/*
* Step (6)
*
* We must release all linked mblks from original packet and keep only
* the first mblk with IP header to link ICMP data.
*/
}
/*
* Append ICMP payload to IP header.
*/
return (0);
}
#endif /* USE_INET6 */
/* ------------------------------------------------------------------------ */
/* Function: fr_make_icmp */
/* Returns: int - 0 on success, -1 on failure */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* We must alter the original mblks passed to IPF from IP stack via */
/* FW_HOOKS. The reasons why we must alter packet are discussed within */
/* comment at fr_make_rst() function. */
/* */
/* The fr_make_icmp() function acts as a wrapper, which passes the code */
/* execution to fr_make_icmp_v4() or fr_make_icmp_v6() depending on */
/* protocol version. However there are some details, which are common to */
/* both IP versions. The details are going to be explained here. */
/* */
/* The packet looks as follows: */
/* xxx | IP hdr | IP payload ... | */
/* ^ ^ ^ ^ */
/* | | | | */
/* | | | fin_m->b_wptr = fin->fin_dp + fin->fin_dlen */
/* | | | */
/* | | `- fin_m->fin_dp (in case of IPv4 points to L4 header) */
/* | | */
/* | `- fin_m->b_rptr + fin_ipoff (fin_ipoff is most likely 0 in case */
/* | of loopback) */
/* | */
/* `- fin_m->b_rptr - points to L2 header in case of physical NIC */
/* */
/* All relevant IP headers are pulled up into the first mblk. It happened */
/* well in advance before the matching rule was found (the rule, which took */
/* us here, to fr_make_icmp() function). */
/* */
/* Both functions will turn packet passed in fin->fin_m mblk into a new */
/* packet. New packet will be represented as chain of mblks. */
/* orig mblk |- b_cont ---. */
/* ^ `-> ICMP hdr |- b_cont--. */
/* | ^ `-> duped orig mblk */
/* | | ^ */
/* `- The original mblk | | */
/* will be trimmed to | | */
/* to contain IP header | | */
/* only | | */
/* | | */
/* `- This is newly | */
/* allocated mblk to | */
/* hold ICMPv6 data. | */
/* | */
/* | */
/* | */
/* This is the copy of original mblk, it will contain -' */
/* orignal IP packet in case of ICMPv6. In case of */
/* ICMPv4 it will contain up to 8 bytes of IP payload */
/* ------------------------------------------------------------------------ */
int fr_make_icmp(fin)
{
int rv;
#ifdef USE_INET6
#endif
else
rv = -1;
return (rv);
}
#endif /* _KERNEL && SOLARIS2 >= 10 */